Cisco Cisco Email Security Appliance C160 Mode D'Emploi

You can also use the $MatchedContent action variable to notify senders or administrators that a content 
filter was triggered. The $MatchedContent action variable displays the content that triggered the filter. 
For example, the following filter sends a notification to an administrator if the email contains ABA 
account information.

You can use the Text Resources page or the 

textconfig

 CLI command to configure custom notification 

templates as text resources for use with the 

notify()

 and 

notify-copy()

 actions. If you do not create a 

custom notification template, a default template is used. The default template includes message headers, 
but the custom notification template does not include message headers by default. To include message 
headers in the custom notification, include the 

$AllHeaders

 action variable. 

 For more information, see the “Text Resources” chapter. 

In the following example, when a large message triggers the filter shown below, an email is sent to the 
intended recipients explaining that the message was too large:

The 

bcc

 action sends an anonymous copy of the message to a specified recipient. This is sometimes 

referred to as message replication. Because no mention of the copy is made in the original message and 
the anonymous copy will never successfully bounce back to the recipient, the original sender and 
recipients of the message will not necessarily know that the copy was sent.

ABA_filter:

if (body-contains ('*aba')){

notify('admin@example.com','[$MatchedContent]Account Information Displayed');

}

bigFilter:

   if (body-size >= 4M)

   {

        notify('$EnvelopeRecipients', '[$FilterName] Message too large',

        drop();

   }